dawnscanner v2.2 releases: static analysis security scanner for ruby

by do son · Published · Updated

Dawnscanner – The raising security scanner for Ruby web applications

dawnscanner is a source code scanner designed to review your ruby code for security issues.

dawnscanner is able to scan plain ruby scripts (e.g. command line applications) but all its features are unleashed when dealing with web applications source code. dawnscanner is able to scan major MVC (Model View Controller) frameworks, out of the box:

dawnscanner version 1.6.6 has 235 security checks loaded in its knowledge base. Most of them are CVE bulletins applying to gems or the ruby interpreter itself. There is also some check coming from Owasp Ruby on Rails cheatsheet.

When you run dawnscanner on your code it parses your project Gemfile.lock looking for the gems used and it tries to detect the ruby interpreter version you are using or you declared in your ruby version management tool you like most (RVM, rbenv, …).

Then the tool tries to detect the MVC framework your web application uses and it applies the security check accordingly. There checks designed to match rails application or checks that are applicable to any ruby code.

It can also understand the code in your views and to backtrack sinks to spot cross-site scripting and sql injections introduced by the code you actually wrote. In the project roadmap, this is the code most of the future development effort will be focused on.

dawnscanner security scan result is a list of vulnerabilities with some mitigation actions you want to follow in order to build a stronger web application.

Changelog v2.0

  • New knowledge base, YAML based and distributed separately from the ruby gem.
  • New CLI based on Thor library. Please read README.md file to know how to invoke dawn the right way or use the ‘dawn help’ command
  • Added a new debug_verbosely API for engines and checks
  • Removed rake osvdb[name] and rake cve[name] tasks
  • Adding telemetry
  • Dawn::Utils include refactory. Now it’s available application wide
  • debug information refactory.
  • engine class, apply_all method now accepts an optional parameter containing a list of security checks to be excluded (issue #230).
  • Fix issue #244. Now the KB path is no more hardcoded but it is relative to $HOME and ‘dawnscanner’ folder where results are stored.
  • Fix issue #245. Pattern matching check is skipped on empty files.

Installation

$ gem install dawnscanner

Usage

$ dawn -h

Usage: dawn [options] target_directory



Examples:

	$ dawn a_sinatra_webapp_directory

	$ dawn -C the_rails_blog_engine

	$ dawn -C --json a_sinatra_webapp_directory

	$ dawn --ascii-tabular-report my_rails_blog_ecommerce

	$ dawn --html -F my_report.html my_rails_blog_ecommerce



   -r, --rails					force dawn to consider the target a rails application (DEPRECATED)

   -s, --sinatra				force dawn to consider the target a sinatra application (DEPRECATED)

   -p, --padrino				force dawn to consider the target a padrino application (DEPRECATED)

   -G, --gem-lock				force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock (DEPRECATED)

   -d, --dependencies				force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock



Reporting



   -a, --ascii-tabular-report			cause dawn to format findings using tables in ascii art (DEPRECATED)

   -j, --json					cause dawn to format findings using json

   -K, --console					cause dawn to format findings using plain ascii text

   -C, --count-only				dawn will only count vulnerabilities (useful for scripts)

   -z, --exit-on-warn				dawn will return number of found vulnerabilities as exit code

   -F, --file filename				tells dawn to write output to filename

   -c, --config-file filename			tells dawn to load configuration from filename



Disable security check family



       --disable-cve-bulletins			disable all CVE security checks

       --disable-code-quality			disable all code quality checks

       --disable-code-style			disable all code style checks

       --disable-owasp-ror-cheatsheet		disable all Owasp Ruby on Rails cheatsheet checks

       --disable-owasp-top-10			disable all Owasp Top 10 checks



Flags useful to query Dawn



   -S, --search-knowledge-base [check_name]	search check_name in the knowledge base

       --list-knowledge-base			list knowledge-base content

       --list-known-families			list security check families contained in dawn's knowledge base

       --list-known-framework			list ruby MVC frameworks supported by dawn

       --list-scan-registry			list past scan informations stored in scan registry 



Service flags



   -D, --debug					enters dawn debug mode

   -V, --verbose				the output will be more verbose

   -v, --version				show version information

   -h, --help

 

 

 

 

 

 

Copyright (c) 2013-2016 Paolo Perego paolo@dawnscanner.org

Source: https://github.com/thesp0nge/

Tags: dawnscanner